| Author: Rajaram 10 Jun 2008 | Member Level: Silver Points : 2 |
SQL Injection is a threat which explores the holes in the application revealing the internals of the database. This also gives control of the database to the hacker.
|
| Author: Kapil Dhawan 11 Jun 2008 | Member Level: Gold Points : 0 |
good
|
| Author: Kumar Velu 11 Jun 2008 | Member Level: Diamond Points : 2 |
SQL Injection is a threat which explores the holes in the application revealing the internals of the database. This also gives control of the database to the hacker.
Its also accepted..
|
| Author: Kumar Velu 12 Jun 2008 | Member Level: Diamond Points : 2 |
It is a trick to inject SQL query/command as an input possibly via web pages. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password. With SQL Injection, it is possible for us to send crafted user name and/or password field that will change the SQL query and thus grant us something else.
Solution to Avoid sql injection:
1) Use parameters with stored procedures.
2) Use parameters with dynamic SQL.
3) Avoid the use of dynamically generated SQL in your code.
|